Forum Discussion
Attempt to get list of Workspaces via REST API results in 401 Unauthorized.
I'm currently using the REST API to list Datasets. This is working just fine. Now, I want to get a list of Workspaces (that my user has access to). To do this, I'm using the call here: https://docs.microsoft.com/en-us/rest/api/power-bi/groups/get-groups
The problem is, I get this error: "The remote server returned an error: (401) Unauthorized."
I went into Azure and updated the permissions for my app to include: Workspace.ReadWrite.All
...but still no dice. I'm using the same code to get my auth header that I use when getting a list of Datasets. Everything else is the same code as well. The only thing I'm changing is the URL for the API call. What else do I need to do to enable this?
I finally found the answer to this issue and wanted to document it here.
The issue is that you don't need to just add API Permissions to an App Registration. You need to also consent to each API Permission (scope) at a user or app level. Now, an admin can grant access for all users (which is what is mentioned by some answers here in this post), but I'm not an admin, so I couldn't do that. What I needed to do was consent as a user to the specific API permissions that I had added to my App Registration.
Unfortunately, I couldn't find a way to do this in the Azure AD interface. In fact, I only found one place anywhere that actually explained how to do this for a *user* (the admin-level consent was mentioned in numerous places). Here is an answer here which talks about the URL needed to grant user consent to an API permission: https://stackoverflow.com/questions/59282141/aadsts65001-the-user-or-administrator-has-not-consented-to-use-the-application
The URLs look like so:
https://login.microsoftonline.com/[Put your Tenant ID here]/oauth2/v2.0/authorize? client_id=[This is your Client ID from your App Registration] &response_type=code &redirect_uri=https://myapp.mycompany.com[This must be the Redirect URI you setup in your App Registration] &response_mode=query &scope=https://graph.microsoft.com/User.Read[This is the scope URL for the API Permission]
Once I (finally) found that example, I was able to piece together a URL to consent to the newly added Workspace API permissions and my code started working. You can find out the "scope" URL for each API permission (which you have to add to the end of the full URL above) by going to your App Registration and clicking on API Permissions and then clicking on any of the API permissions you've added. This will bring up a window which shows the URL for that API Permission.
17 Replies
I finally found the answer to this issue and wanted to document it here.
The issue is that you don't need to just add API Permissions to an App Registration. You need to also consent to each API Permission (scope) at a user or app level. Now, an admin can grant access for all users (which is what is mentioned by some answers here in this post), but I'm not an admin, so I couldn't do that. What I needed to do was consent as a user to the specific API permissions that I had added to my App Registration.
Unfortunately, I couldn't find a way to do this in the Azure AD interface. In fact, I only found one place anywhere that actually explained how to do this for a *user* (the admin-level consent was mentioned in numerous places). Here is an answer here which talks about the URL needed to grant user consent to an API permission: https://stackoverflow.com/questions/59282141/aadsts65001-the-user-or-administrator-has-not-consented-to-use-the-application
The URLs look like so:
https://login.microsoftonline.com/[Put your Tenant ID here]/oauth2/v2.0/authorize? client_id=[This is your Client ID from your App Registration] &response_type=code &redirect_uri=https://myapp.mycompany.com[This must be the Redirect URI you setup in your App Registration] &response_mode=query &scope=https://graph.microsoft.com/User.Read[This is the scope URL for the API Permission]
Once I (finally) found that example, I was able to piece together a URL to consent to the newly added Workspace API permissions and my code started working. You can find out the "scope" URL for each API permission (which you have to add to the end of the full URL above) by going to your App Registration and clicking on API Permissions and then clicking on any of the API permissions you've added. This will bring up a window which shows the URL for that API Permission.
Shared capacity or Premium?
I think the call you are referencing is only applicable to Premium environments.
Hi Anonymous
Please check whether you have grant admin consent in your API Permission.
Here are two posts with similar errors like yours.
For reference:
Power Bi REST API - 401 Authorization error when using Service Principals
Power Bi REST API - 401 Authorization error when using app secret
Best Regards,
Rico Zhou
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Hi Anonymous
Can you see green icon "Granted for ..." on the right side of "Workspace..." as below? If you couldn't see green icon, the admin hasn't grant consent for it. That "Grant admin consent for..." checkbox is grayed out on your screen.
Please refer to blog as below for more details about "Grant admin consent for..." function.
For reference: Enable the admin consent workflow
Best Regards,
Rico Zhou
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
In the error response, did you get a message about performing an "interactive" request for admin consent?
Ok. When you added the new Scope to you app, perhaps it is not Admin Consented to the User that you are trying to use. Try this...
In Azure Active Directory
- Go to Users, Select your user
- Click Applications on the Left
- Click the Application in the list that has the new Scope you just added
- You will see an Assignment Detail screen... at the bottom, click View Granted Permissions
- You will see a Permissions & Content screen... Search the list to make sure the new scope is in the list granted to your user. If not, add it now and try again.
